Information on the processing of personal data pursuant to Art. 13 of Regulation (EU) 2016/679 (“GDPR”)

Coesia S.p.a., as identified below, provides the following information about how the personal data of users is processed when, via forms available on the website, they request information - which might include the download of brochures - or sets of information.

Joint controller
Coesia S.p.a. (hereinafter also “Controller” or Company”), with registered office at Via Battindarno 91, 40133 Bologna, Italy, VAT no. 02221441203, is a joint controller of the personal data processing described below, together with each of the Coesia Group companies specified in the final section of this policy, pursuant to art. 26 GDPR. Coesia S.p.a. may be contacted by telephone at +39 051 6474111 or by e-mail at privacy@coesia.com

Data Protection Officer
Coesia has appointed a DPO for its Italian Group companies, who may be contacted at this address dpo@coesia.com.

Purposes and lawfulness of processing
Coesia will process the personal data of users for the following purposes:

satisfy and execute requests (e.g. for the download of brochures) made by users via completion of the relevant form, pursuant to Art. 6(1.b) GDPR;
following the receipt of optional specific consent, send users information and promotional/commercial information about the activities, products and services of Coesia Group companies operating in the advanced automated machinery, industrial process solutions and high performance transmissions sectors, pursuant to Art. 6(1.a) GDPR.
following the receipt of optional specific consent, use tracking pixels, being very small images that are sometimes transparent, to analyse how users interact with marketing materials sent by the Company, checking for example whether the message is opened and, if so, the time spent reading it, as well as whether or not attachments are downloaded and/or links are clicked. All this data is used exclusively for the purpose of evaluating and possibly improving the communications sent.
The provision of personal data for purpose 1 is necessary, so that Coesia can reply to and satisfy the requests made by users; if the data is not provided, Coesia will be unable to respond to the request forms submitted.
The provision of personal data for purposes 2 and 3 is not mandatory, but if consent for the processing of personal data is denied, or not given in the case of point 2 above, the Company will be unable to send e-mail communications to the users concerned. If consent for purpose 3 is revoked, the Company will be unable to collect data on the interactions with the e-mails sent. To be clear, users are free to decide whether or not to give consent. In addition, users may withdraw the consents given for each purpose, i.e. for either one or the other, or for both, at any time and without need to give an explanation.

Personal data retention period
In relation to purpose 1 (satisfy user requests submitted via the online form), Coesia will process the personal data collected for the time needed to manage and respond to the request and, in all cases, for no more than 6 (six) months afterwards.
In relation to purpose 2 (communications of an informative, promotional and/or commercial nature), Coesia will process the personal data of users for 5 (five) years following receipt of consent given by potential customers and for 10 (ten) years following the receipt of consent given by customers. In case of un-subscription or withdrawal of consent, Coesia will delete the personal data of the users concerned as soon as possible, consistent with technical requirements (in all cases, within 5 days of the request); consequently, those users will no longer receive communications from Coesia or other joint controllers.

Recipients of personal data
Personal data may be processed by Coesia personnel duly authorised and expressly designated to process personal data, by external professionals if necessary for the above purposes, and by the following parties appointed as Processors pursuant to Art. 28 GDPR:

providers of e-mail and cloud storage services;
providers of pixel tracking services;
providers of servers that host the website;
companies that maintain the IT systems;
companies appointed to develop and administer the website;
Coesia Group companies responsible for the coordination of marketing activities;
providers of CRM systems;
providers of e-mail marketing services.

When users consent to purpose 2, their personal data will be communicated to the Group companies listed below, which act as joint controllers together with Coesia S.p.a. for the purpose of sending promotional communications.
Their data may also be communicated to supervisory bodies, the judiciary, the police, public bodies and any other parties to which such communications must be made by law (art. 6(1.c) GDPR). The above parties will process this data in their capacity as independent controllers.

Transfer abroad of personal data
Personal data is not transferred outside of the European Union. However, should this become necessary, it is understood that we may transfer personal data outside of the EEA, with the firm assurance that such transfer will comply with the applicable legal requirements:

in the event of international transfers of personal data from the European Economic Area (EEA) to a non-EEA country, the transfer may take place if the European Commission has recognised that the non-EEA country provides adequate data protection guarantees: in such cases, personal data may be transferred on this basis;
for transfers to non-EEA countries whose level of protection has not been recognised as adequate by the European Commission, we may rely on an exception applicable in the specific situation and, therefore, sign - if and to the extent necessary - specific agreements that guarantee adequate protection for the personal data or, in any case, adopt the standard contractual clauses stipulated by the European Commission for the transfer of personal data outside of the EU.

Rights of data subjects
Without prejudice to the restrictions placed on the exercise of the rights of data subjects by Arts. 2-(11) and 2-(12) of Decree 196/2003 (“Code for the protection of personal data”) as amended, users may exercise the rights recognised pursuant to and within the limits of Arts. 15-21 GDPR, including the right to ask Coesia for access to their personal data, for its rectification or erasure and for the restriction of data processing that relates to them, as well as to object to its processing and to request its portability.
Users are also entitled, at any time, to withdraw consents given for the processing of their personal data, without this prejudicing the lawfulness of processing based on said consents prior to their revocation. Users may withdraw their consent to receive information and marketing communications by e-mail and/or to receive tracking pixels, either by writing to the Company or by clicking on the link provided at the foot of each e-mail.
Lastly, users may lodge a complaint with a competent supervisory authority pursuant to Art. 77(1) GDPR, this being the “Garante privacy” in Italy (Italian Data Protection Authority). Complaints may also be lodged with a non-Italian supervisory authority, if that authority is responsible for the EU State in which the data subjects concerned habitually reside or work, or for the location where the alleged infringement took place.
Users may exercise the above rights by sending a written communication to the registered office of Coesia indicated above, to the following e-mail address privacy@coesia.com, or to the addresses given below of the Group companies that are joint controllers.

List of Coesia Group companies that are joint controllers
The individual Group companies with which Coesia S.p.a. is a joint controller for the purposes described in this privacy policy are listed below pursuant to art. 26 GDPR. Data subjects may consult the essential contents of the joint controllership agreement at any time, by writing to the addresses given in this section, or in the first section with regard to Coesia S.p.a.:
Italian companies:

CIMA S.p.A., Via Cairoli 8, 40055 Catenaso, Bologna
A.C.M.A. S.p.A., Via C. Colombo 1, 40131 Bologna
EMMECI S.p.A., Via 8 Marzo 3, 50050 Cerreto Guidi, Florence
System Ceramics S.p.A., Via Ghiarola Vecchia 73, 41042 Fiorano Modenese, Modena
G.D S.p.A., Via Battindarno 91, 40133 Bologna
GDM S.p.A., Via Battindarno 91, 40133 Bologna
GF S.p.A., Via Edison 3, 43040 Solignano, Parma
CO.ME.SCA S.r.l., Viale John Fitzgerald Kennedy 168 (Ex Scarperia), 50038 Scarperia e San Piero, Florence
PE.BO S.r.l., Via Internati 1943/45, 31057 Silea, Treviso
COMAS S.p.A., via Cendon 1, 31057 Silea, Treviso
SASIB S.p.A., Via Giuseppe Di Vittorio 21/B, 40013 Castel Maggiore, Bologna
Flexlink Systems S.p.A., Via Chivasso 15, 10098 Rivoli (Frazione Cascine Vica), Turin
Coesia Finance S.p.A., Via Battindarno 91, 40133 Bologna
Lesina Autonoleggio S.r.l., Via Battindarno 91, 40133 Bologna
Nova Prefabbricati S.r.l., Via Marconi 8, 40122 Bologna

EU companies:

AMACO Gmbh, Dornbirner Str. 19, 6890 Lustenau, Austria
Atlantic Zeiser GmbH, Carl-Benz-Straße 16, 78576 Emmingen-Liptingen - Germany
Citus Kalix SAS, Avenue du Bois de l'Epine 6, 91080, Courcouronnes, France
Emmeci Europa Sarl, Zi de la mare blanche - 26, rue de la mare blanche, Noisielle, France
Flexlink AB, Byfogdegatan 11 - 415 50, Goteborg, Sweden
Flexlink Systems GmbH, Schumannstr. 155, 63069, Offenbach am Main, Germany
Franssons Maskinbearbetning AB, Dokumentvaegen 40, S-394 70, Kalmar, Sweden
G.D Automatische Verpackungsmachinen GmbH, Hans-Böckler-Straße 6-8, 40764 Langenfeld, Germany
G.D Poland Sp. z o.o., ul. Swietojerska 5/7, 00-236, Warsaw, Poland
MOLINS S.R.O., Plzen, Korandová 2883/12, 301 00, Czech Republic
Norden Machinery AB, Prästkragevägen 15 | SE-393 61 KALMAR, Sweden
Volpak, S.A.U., Pol. Ind. Can Vinyalets, C/ Can Vinyalets, 4, 08130 Santa Perpétua de Mogoda, Barcelona, Spain